New Supply Chain Attack Exploits Abandoned S3 Buckets to Distribute Malicious Binaries

In what's a new kind of software supply chain attack aimed at open source projects, it has emerged that threat actors could seize control of expired Amazon S3 buckets to serve rogue binaries without altering the modules themselves. "Malicious binaries steal the user IDs, passwords, local machine...

Malicious code in audit-ejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx cc5e978bbf3ec0126449bcb0fd362d6238bf3e8658c2e85a28fa9f68128e7227 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-948 Malicious code in vue-gws (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 557d3dde7707f6cebfde77623067da836191b95969867f4855b6706e5a027e56 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-172 Malicious code in chart-vxe (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 002bd97e07b258e0171a9659dd1196fa1fde9398bb98fd5ac8213b966f9e40df Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-304 Malicious code in elliptic-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 0ffc8361769988057a4d6c1f79b5cdcf930ac38ce3f5243cd2af71837be266c1 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

Malicious code in elliptic-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 3f5aa19fd478d27d6a061c40dbabd597ef510b0bc122de0b4da84de18f478059 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-171 Malicious code in chart-tablejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c6d78e3ccec4aa1bcee41b14b382246c7efaf8a725582a9ab36550d8fc6cb203 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-951 Malicious code in vuewjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b899bfc2ad4cc34bb998c5775bb55e7aa7410d54e7fd924f62d666bae1ad40c6 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-912 Malicious code in ttf-metadata (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a8165c5b54908b5702e7a9b3b1fb7ac5d71d1ba10ea6e426237f526c4dfe1a91 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

Adversaries increasingly using vendor and contractor accounts to infiltrate networks

Cisco Talos Incident Response Talos IR has repeatedly observed attackers targeting and using compromised vendor and contractor accounts VCAs during recent emergency response engagements. While high-profile software supply chain compromise events garner significant media attention e.g., the recent...

PyPI Implements Mandatory Two-Factor Authentication for Project Owners

The Python Package Index PyPI announced last week that every account that maintains a project on the official third-party software repository will be required to turn on two-factor authentication 2FA by the end of the year. "Between now and the end of the year, PyPI will begin gating access to...

Design/Logic Flaw

Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the intoto/v0.0.2 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error...

CVE-2023-33199 malformed proposed intoto v0.0.2 entries can cause a panic in Rekor

Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the intoto/v0.0.2 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error...

CVE-2023-33199 malformed proposed intoto v0.0.2 entries can cause a panic in Rekor

Rekor's goals are to provide an immutable tamper resistant ledger of metadata generated within a software projects supply chain. A malformed proposed entry of the intoto/v0.0.2 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error...

GUAC 0.1 Beta: Google's Breakthrough Framework for Secure Software Supply Chains

Google on Wednesday announced the 0.1 Beta version of GUAC short for Graph for Understanding Artifact Composition for organizations to secure their software supply chains. To that end, the search giant is making available the open source framework as an API for developers to integrate their own...

The Rising Threat of Secrets Sprawl and the Need for Action

The most precious asset in today's information age is the secret safeguarded under lock and key. Regrettably, maintaining secrets has become increasingly challenging, as highlighted by the 2023 State of Secrets Sprawl report, the largest analysis of public GitHub activity. The report shows a 67%...

MAL-2023-950 Malicious code in vue2ejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 471c4327f895aee34fd25c781189cda3025f1a3d22c0bba59cd767f95a277194 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

Hackers Using Golang Variant of Cobalt Strike to Target Apple macOS Systems

A Golang implementation of Cobalt Strike called Geacon is likely to garner the attention of threat actors looking to target Apple macOS systems. That's according to findings from SentinelOne, which observed an increase in the number of Geacon payloads appearing on VirusTotal in recent months...

Malicious code in ipsecurity (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a051635703d3a602e1b05da35aa26561b2f211a4625fe23054dd6d8f6b44757b Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-1554 Malicious code in ipstringfy (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx deea2822e14722106952d830748fc4b8c86f7613827ea90caaeb796f9a9eb9f4 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...